Use calico with enabled SELinux in K3s

[xoxys]

Hi,

Using Calico on K3s with --selinux enabled failed due to volume permission issues.

Tigera Operator Pod log:

{"level":"error","ts":1668807146.5259209,"logger":"controller_installation","msg":"ResourceReadError","Request.Namespace":"tigera-operator","Request.Name":"node-certs","ResourceReadError":"error reading network MTU","error":"open /var/lib/calico/mtu: permission denied","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:214"}
{"level":"error","ts":1668807146.5260344,"logger":"controller.tigera-installation-controller","msg":"Reconciler error","name":"node-certs","namespace":"tigera-operator","error":"open /var/lib/calico/mtu: permission denied","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:214"}
{"level":"error","ts":1668807146.6330335,"logger":"controller_installation","msg":"ResourceReadError","Request.Namespace":"tigera-operator","Request.Name":"tigera-ca-private","ResourceReadError":"error reading network MTU","error":"open /var/lib/calico/mtu: permission denied","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:214"}

Audit log:

type=AVC msg=audit(1668780552.429:28400): avc:  denied  { read } for  pid=7884 comm="operator" name="mtu" dev="dm-6" ino=8566484 scontext=system_u:system_r:container_t:s0:c38,c692 tcontext=system_u:object_r:container_var_lib_t:s0 tclass=file permissive=0

Is this something that can be fixed by the K3s SELinux policy, or does it need to be fixed elsewhere? Thanks for your help.

[xoxys]

See projectcalico/calico#7851 (comment)